[mlir][transform](transform-interpreter) mlir-opt crashes at ArrayRef.h:247 with assertion `Index < Length && "Invalid index!"' failed.
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
git version: 092858485f00e6786da8a88c0c4d462247e64571
MLIR Program:
```mlir
module {
module attributes {transform.with_named_sequence} {
transform.named_sequence @__transform_main(%arg0: !transform.any_op {transform.readonly}) {
%0 = transform.structured.match ops{["tensor.insert_slice"]} in %arg0 : (!transform.any_op) -> !transform.any_op
transform.structured.vectorize %0 vector_sizes [8, 1] : !transform.any_op
transform.yield
}
}
func.func @m0() -> tensor<5x6x128xf32> {
%cst = arith.constant 1.000000e+00 : f32
%cst_0 = arith.constant 2.000000e+00 : f32
%0 = tensor.empty() : tensor<5x6x64xf32>
%1 = linalg.fill ins(%cst : f32) outs(%0 : tensor<5x6x64xf32>) -> tensor<5x6x64xf32>
%2 = tensor.empty() : tensor<5x6x64xf32>
%3 = linalg.fill ins(%cst_0 : f32) outs(%2 : tensor<5x6x64xf32>) -> tensor<5x6x64xf32>
%4 = tensor.empty() : tensor<5x6x128xf32>
%inserted_slice = tensor.insert_slice %1 into %4[0, 0, 0] [5, 6, 64] [1, 1, 1] : tensor<5x6x64xf32> into tensor<5x6x128xf32>
%inserted_slice_1 = tensor.insert_slice %3 into %inserted_slice[0, 0, 64] [5, 6, 64] [1, 1, 1] : tensor<5x6x64xf32> into tensor<5x6x128xf32>
return %inserted_slice_1 : tensor<5x6x128xf32>
}
}
```
Reproduce Command: `mlir-opt -transform-interpreter a.mlir`
StackTrace:
```
mlir-opt: /data2/dependency/dev/llvm-project/llvm/include/llvm/ADT/ArrayRef.h:247: const T& llvm::ArrayRef::operator[](size_t) const [with T = long int; size_t = long unsigned int]: Assertion `Index < Length && "Invalid index!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /data2/dependency/dev/llvm-project/build/bin/mlir-opt -transform-interpreter a.mlir
#0 0x000056531851415f llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x25c715f)
#1 0x000056531851092c llvm::sys::RunSignalHandlers() (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x25c392c)
#2 0x0000565318510ac7 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007feefac9b420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
#4 0x00007feefa78600b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b)
#5 0x00007feefa765859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859)
#6 0x00007feefa765729 (/lib/x86_64-linux-gnu/libc.so.6+0x22729)
#7 0x00007feefa776fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
#8 0x000056531f091b75 (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x9144b75)
#9 0x000056531f0b1872 mlir::linalg::vectorize(mlir::RewriterBase&, mlir::Operation*, llvm::ArrayRef, llvm::ArrayRef, bool, bool, bool, bool) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x9164872)
#10 0x00005653192598d3 mlir::transform::VectorizeOp::apply(mlir::transform::TransformRewriter&, mlir::transform::TransformResults&, mlir::transform::TransformState&) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x330c8d3)
#11 0x000056531914b14b mlir::transform::detail::TransformOpInterfaceInterfaceTraits::Model::apply(mlir::transform::detail::TransformOpInterfaceInterfaceTraits::Concept const*, mlir::Operation*, mlir::transform::TransformRewriter&, mlir::transform::TransformResults&, mlir::transform::TransformState&) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x31fe14b)
#12 0x000056531ec24f6d mlir::transform::TransformState::applyTransform(mlir::transform::TransformOpInterface) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x8cd7f6d)
#13 0x000056531ebb2db9 applySequenceBlock(mlir::Block&, mlir::transform::FailurePropagationMode, mlir::transform::TransformState&, mlir::transform::TransformResults&) TransformOps.cpp:0:0
#14 0x000056531ebd4574 mlir::transform::NamedSequenceOp::apply(mlir::transform::TransformRewriter&, mlir::transform::TransformResults&, mlir::transform::TransformState&) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x8c87574)
#15 0x000056531eb2bc03 mlir::transform::detail::TransformOpInterfaceInterfaceTraits::Model::apply(mlir::transform::detail::TransformOpInterfaceInterfaceTraits::Concept const*, mlir::Operation*, mlir::transform::TransformRewriter&, mlir::transform::TransformResults&, mlir::transform::TransformState&) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x8bdec03)
#16 0x000056531ec24f6d mlir::transform::TransformState::applyTransform(mlir::transform::TransformOpInterface) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x8cd7f6d)
#17 0x000056531ec268b1 mlir::transform::applyTransforms(mlir::Operation*, mlir::transform::TransformOpInterface, mlir::RaggedArray> const&, mlir::transform::TransformOptions const&, bool, llvm::function_ref, llvm::function_ref) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x8cd98b1)
#18 0x000056531eb134c0 mlir::transform::applyTransformNamedSequence(mlir::RaggedArray>, mlir::transform::TransformOpInterface, mlir::ModuleOp, mlir::transform::TransformOptions const&) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x8bc64c0)
#19 0x000056531eb0ee6f (anonymous namespace)::InterpreterPass::runOnOperation() InterpreterPass.cpp:0:0
#20 0x000056532132be11 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0xb3dee11)
#21 0x000056532132c1a0 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0xb3df1a0)
#22 0x000056532132e254 mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0xb3e1254)
#23 0x000056532132f2e1 mlir::PassManager::run(mlir::Operation*) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0xb3e22e1)
#24 0x00005653185da1bb performActions(llvm::raw_ostream&, std::shared_ptr const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#25 0x00005653185dac63 processBuffer(llvm::raw_ostream&, std::unique_ptr>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) MlirOptMain.cpp:0:0
#26 0x00005653185daeeb llvm::LogicalResult llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr>, llvm::MemoryBufferRef, llvm::raw_ostream&)>(long, std::unique_ptr>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#27 0x0000565321706d65 mlir::splitAndProcessBuffer(std::unique_ptr>, llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0xb7b9d65)
#28 0x00005653185d0ff4 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (.part.0) MlirOptMain.cpp:0:0
#29 0x00005653185db407 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x268e407)
#30 0x00005653185db643 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x268e643)
#31 0x0000565318440b1c main (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x24f3b1c)
#32 0x00007feefa767083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#33 0x00005653184f086e _start (/data2/dependency/dev/llvm-project/build/bin/mlir-opt+0x25a386e)
Aborted (core dumped)
```
Contributor guide
Research direction
Start by running the supplied MLIR program with `mlir-opt -transform-interpreter a.mlir`. Inspect `mlir::transform::VectorizeOp::apply` and `mlir::linalg::vectorize` from the stack trace, then trace the invalid `ArrayRef` access in `ArrayRef.h:247`. Done means the reproducer no longer aborts; the payload names no regression-test file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100